Security Radar

CVE-2022-22265 Severity under analysis added on 09/18/2023

Samsung Mobile Devices Use-After-Free Vulnerability

Samsung · Mobile Devices · CWE-703

Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution.

CVE-2021-3129 Severity under analysis Ransomware added on 09/18/2023

Laravel Ignition File Upload Vulnerability

Laravel · Ignition

Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().

CVE-2017-6884 Severity under analysis Ransomware added on 09/18/2023

Zyxel EMG2926 Routers Command Injection Vulnerability

Zyxel · EMG2926 Routers · CWE-78

Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.

CVE-2014-8361 Severity under analysis added on 09/18/2023

Realtek SDK Improper Input Validation Vulnerability

Realtek · SDK · CWE-20

Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.

CVE-2023-26369 Severity under analysis added on 09/14/2023

Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability

Adobe · Acrobat and Reader · CWE-787

Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.

CVE-2023-4863 Severity under analysis added on 09/13/2023

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Google · Chromium WebP · CWE-787

Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.

CVE-2023-35674 Severity under analysis added on 09/13/2023

Android Framework Privilege Escalation Vulnerability

Android · Framework

Android Framework contains an unspecified vulnerability that allows for privilege escalation.

CVE-2023-20269 Severity under analysis Ransomware added on 09/13/2023

Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability

Cisco · Adaptive Security Appliance and Firepower Threat Defense · CWE-288

Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.

CVE-2023-36802 Severity under analysis added on 09/12/2023

Microsoft Streaming Service Proxy Privilege Escalation Vulnerability

Microsoft · Streaming Service Proxy · CWE-416

Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.

CVE-2023-36761 Severity under analysis added on 09/12/2023

Microsoft Word Information Disclosure Vulnerability

Microsoft · Word · CWE-668

Microsoft Word contains an unspecified vulnerability that allows for information disclosure.

CVE-2023-41064 Severity under analysis added on 09/11/2023

Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability

Apple · iOS, iPadOS, and macOS · CWE-120

Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.

CVE-2023-41061 Severity under analysis added on 09/11/2023

Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability

Apple · iOS, iPadOS, and watchOS

Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.

CVE-2023-33246 Severity under analysis added on 09/06/2023

Apache RocketMQ Command Execution Vulnerability

Apache · RocketMQ · CWE-94

Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.

CVE-2023-38831 Severity under analysis Ransomware added on 08/24/2023

RARLAB WinRAR Code Execution Vulnerability

RARLAB · WinRAR · CWE-351

RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.

CVE-2023-32315 Severity under analysis added on 08/24/2023

Ignite Realtime Openfire Path Traversal Vulnerability

Ignite Realtime · Openfire · CWE-22

Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.

CVE-2023-38035 Severity under analysis Ransomware added on 08/22/2023

Ivanti Sentry Authentication Bypass Vulnerability

Ivanti · Sentry · CWE-863

Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

CVE-2023-27532 Severity under analysis Ransomware added on 08/22/2023

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

Veeam · Backup & Replication · CWE-306

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

CVE-2023-26359 Severity under analysis added on 08/21/2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe · ColdFusion · CWE-502

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.

CVE-2023-24489 Severity under analysis added on 08/16/2023

Citrix Content Collaboration ShareFile Improper Access Control Vulnerability

Citrix · Content Collaboration · CWE-284

Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.

CVE-2023-38180 Severity under analysis added on 08/09/2023

Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability

Microsoft · .NET Core and Visual Studio

Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).

CVE-2017-18368 Severity under analysis added on 08/07/2023

Zyxel P660HN-T1A Routers Command Injection Vulnerability

Zyxel · P660HN-T1A Routers · CWE-78

Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.

CVE-2023-35081 Severity under analysis added on 07/31/2023

Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability

Ivanti · Endpoint Manager Mobile (EPMM) · CWE-22

Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).

CVE-2023-37580 Severity under analysis added on 07/27/2023

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS) · CWE-79

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.

CVE-2023-38606 Severity under analysis added on 07/26/2023

Apple Multiple Products Kernel Unspecified Vulnerability

Apple · Multiple Products

Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.